70% of the web runs on code with a serious hole

Seventy percent of the internet runs on a single piece of software with a critical flaw. That software is PHP, an open-source programming language that powers a massive share of global websites. OpenAI announced on Tuesday, October 21, that its AI model GPT-5.6 Sol helped uncover serious security vulnerabilities in this code. The discovery has triggered a coordinated effort to fix the issues before they can be widely exploited.

The bugs were not immediately obvious to human developers. The PHP Foundation had known about the underlying issue since 2024. However, the team could not find a way to exploit the flaw or a way to fix it. That changed when researchers from Calif, a California-based cybersecurity firm, began auditing PHP with AI tools on July 30. On August 11, a Calif researcher identified the exploitable vulnerability. OpenAI researchers confirmed the finding the same day.

A second vulnerability was independently identified by the cybersecurity firm Wiz. The two issues are tracked as CVE-2026-109618 and CVE-2026-109619. They involve errors in how PHP manages computer memory and handles errors. Both flaws received a critical severity score of 9.2 out of 10. This high rating reflects the potential damage an attacker could cause.

The first flaw occurs when PHP runs out of allocated memory while processing a request. This can leave behind incomplete internal data that the engine later mistakes for valid information. The second flaw happens when a fatal error leaves PHP pointing to memory that has already been freed. Subsequent requests can then access or corrupt that memory. These weaknesses allow attackers to remotely execute malicious code on affected servers without needing login credentials.

Using AI, the researchers demonstrated that these flaws could expose sensitive data stored in server memory. This includes passwords, authentication tokens, and API keys. The most concerning aspect is that the vulnerabilities exist in PHP's core engine. This means websites can be affected even if their specific application code is secure. The bugs affect the foundation of the system rather than just the surface layers.

The PHP Foundation released patched versions on Tuesday. The new versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Sites running PHP 8.1 or older versions will not receive official fixes. The release was originally scheduled for Wednesday, October 22. It was brought forward to Tuesday after premature disclosures on Monday, October 20, caused public concern.

OpenAI stated that every site using PHP can now safely upgrade its version to stay secure. The company calls this one of the biggest cybersecurity discoveries of 2026. It cites the incident as an example of its "Defender's Window" concept. This concept describes a narrow timeframe where organizations can use advanced AI to find and patch flaws before those same AI capabilities become widely available to malicious actors.

The timeline highlights the speed of AI-assisted research. Human developers spent two years trying to resolve the flaw without success. AI-wielding researchers demonstrated practical exploitation methods within two weeks. OpenAI argues that powerful technology will inevitably be used by bad actors. Therefore, it is a collective responsibility to proactively address exploitable flaws. Other firms, like Anthropic, have also identified thousands of zero-day vulnerabilities in major operating systems and browsers using similar methods.